General
-
Target
draft_document.xls
-
Size
288KB
-
Sample
221207-mttt9acg3s
-
MD5
c331493a8114f141e781d1e6ef313d8b
-
SHA1
40efd1edbb958610037ac48bfea8efe1b42fb572
-
SHA256
a2ba99d5d1fb282868cb3598dc25221aa4e14db381bfd0288be19ac452ca58fe
-
SHA512
8c14ff3c9cc20ad57eccf7e739439355eede324d59528fa50145a9f0aa957143044f1954185d60b5439ace8b0dbe979508041b10b2563b97fe27e515c8e1d629
-
SSDEEP
6144:1k/iZ+RwPONXoRjDhIcp0fDlavx+W26nAUrxOFJkWraDUff4xpqsCou28n2cxfj8:1KsOFiWrN4xRk2awT
Static task
static1
Behavioral task
behavioral1
Sample
draft_document.xls
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
draft_document.xls
Resource
win10v2004-20221111-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
host39.registrar-servers.com - Port:
587 - Username:
[email protected] - Password:
payment 12345
Targets
-
-
Target
draft_document.xls
-
Size
288KB
-
MD5
c331493a8114f141e781d1e6ef313d8b
-
SHA1
40efd1edbb958610037ac48bfea8efe1b42fb572
-
SHA256
a2ba99d5d1fb282868cb3598dc25221aa4e14db381bfd0288be19ac452ca58fe
-
SHA512
8c14ff3c9cc20ad57eccf7e739439355eede324d59528fa50145a9f0aa957143044f1954185d60b5439ace8b0dbe979508041b10b2563b97fe27e515c8e1d629
-
SSDEEP
6144:1k/iZ+RwPONXoRjDhIcp0fDlavx+W26nAUrxOFJkWraDUff4xpqsCou28n2cxfj8:1KsOFiWrN4xRk2awT
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-